Privacy

Privacy policy

Last updated 16 October 2026

runinto is built so that a map of your friends can't turn into tracking. This page explains exactly what the app and our servers handle. The short version is the privacy contract below, which the app shows word for word and the server enforces.

The privacy contract

1. Nobody can see you unless they are your friend and within 1 mile of you right now.
2. It's mutual: if someone can see you, you can see them. "Who can see me" and "who I can see" are the same list.
3. Ghost mode hides you from everyone. While you're a ghost, you can't see anyone either.
4. Hide from someone and neither of you sees the other. They aren't told.
5. Block someone and they can never see you, find you by number, or add you again, even if you blocked their number before they joined.
6. Where your friends are outside the 1-mile circle is never sent to your phone, in any form.
7. We don't keep a location history. Your live location expires on its own. The only places kept are meetups you and your friend both chose to save, stored as a place name, never coordinates.

What we collect

• Your phone number, to sign you in with a text message code. We store it encrypted, plus a keyed hash so friends' contacts can find you. We never show it to other people.
• Your name and profile photo, which your friends see.
• Your contacts' phone numbers, hashed on your phone, if you allow contacts access. They're used only to find friends who are already on runinto. We don't receive names or any other contact details.
• Your live location, while sharing is on. It's held in memory only, expires on its own within 30 minutes, and is never written to a database. Friends only ever receive it while you're within a mile of each other.
• Meetups you and a friend both save: a place name, a rough area (about 5 km), the time and an optional photo. Never exact coordinates.
• Your settings: friends, requests, blocks, hidden people, ghost mode, precision and quiet hours.
• A record of who could see you and when (names and times, no places), so the app can show you the last 7 days.
• Device details we need to run the service: a push notification token, and an App Attest key that proves requests come from a genuine copy of the app.

What we never do

• We don't keep a location history, and we don't sell or share location with anyone.
• We don't show ads, and we don't use third-party advertising or analytics trackers.
• We don't send a friend your location when you're more than a mile apart, in any form.

Who helps us run runinto

• Railway hosts our servers and database in the EU (Amsterdam).
• Twilio sends the sign-in text messages, so it receives your phone number.
• Apple delivers push notifications and checks App Attest.

They process data only to provide those services to us.

How long we keep things

Live location expires within 30 minutes. Everything else is kept while your account exists. When you delete your account in the app, your name, photo, phone number match and sessions are removed right away, you disappear from everyone's map, and the rest of your account is deleted afterwards.

Your choices

• Turn on ghost mode, hide from specific people, or set friends to fuzzy precision at any time.
• Turn off location or contacts access in iOS Settings. runinto keeps working with less.
• Delete your account from your profile in the app.

Children

runinto isn't meant for children under 13, and we don't knowingly let them sign up.